Merge RB-12 + RB-15 + RB-16 — route-table authz gate, Swagger dev-only, peildatum 400

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

# Conflicts:
#	libs/shared/docs/behaviour-spec.mdx

libs/shared/docs/behaviour-spec.mdx

@@ -21,7 +21,7 @@ tested where._
 Every bullet below is a real test name from the suite — an `it()` title (frontend) or a test
 method name (backend), read as a sentence. Nothing here is hand-written prose: this page
 **is** the suite, reshaped for a business reader. 451 frontend behaviours across
-9 contexts; 231 backend behaviours across 39 test
+9 contexts; 236 backend behaviours across 41 test
 classes.
 
 ## Frontend (by context)
@@ -1153,12 +1153,18 @@ classes.
 - A closed mapping is absent from its geldigTot onwards
 - ByProgram is evaluated per call not captured at type load
 
+### RouteInventoryTests
+
+- Every mapped route is authz gated or on the named allow list
+- Every gate marker names a known admin wrapper
+
 ### StamdataEndpointTests
 
 - Stamdata reads are admin only
 - Table list exposes the reflected schema
 - Table returns all rows without a peildatum
 - Peildatum before the seed windows hides every row
+- Unparseable peildatum is 400 not 500
 - Unknown table is 404
 
 ### StamdataValidationTests
@@ -1189,6 +1195,11 @@ classes.
 - Worked hours are accepted
 - Phone change is validated
 
+### SwaggerGateTests
+
+- Swagger document is served in development
+- Swagger document is not served outside development
+
 ### UploadAccessTests
 
 - The owner can read the bytes

libs/shared/src/infrastructure/api-client.ts

@@ -341,6 +341,12 @@ export class ApiClient {
             result200 = _responseText === "" ? null : JSON.parse(_responseText, this.jsonParseReviver) as StamdataTableDto;
             return result200;
             });
+        } else if (status === 400) {
+            return response.text().then((_responseText) => {
+            let result400: any = null;
+            result400 = _responseText === "" ? null : JSON.parse(_responseText, this.jsonParseReviver) as ProblemDetails;
+            return throwException("Bad Request", status, _responseText, _headers, result400);
+            });
         } else if (status === 403) {
             return response.text().then((_responseText) => {
             let result403: any = null;